Security: vitejs/vite
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
`server.fs.deny` bypassed for `inline` and `raw` with `?import` queryGHSA-4r4m-qw57-chr8 published
Mar 31, 2025 by patak-catModerate -
server.fs.deny bypassed when using `?raw??`GHSA-x574-m823-4x7w published
Mar 24, 2025 by sapphi-redModerate -
Any websites were able to send any requests to the development server and read the responseGHSA-vg6x-rcgg-rjx6 published
Jan 20, 2025 by sapphi-redModerate -
DOM Clobbering gadget found in vite bundled scripts that leads to XSSGHSA-64vr-g452-qvp3 published
Sep 17, 2024 by patak-catModerate -
server.fs.deny bypassed when using ?import&rawGHSA-9cwx-2883-4wfx published
Sep 17, 2024 by patak-catModerate -
`server.fs.deny` did not deny requests for patterns with directories.GHSA-8jhw-289h-jh2g published
Apr 3, 2024 by sapphi-redModerate -
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemGHSA-c24v-8rfc-w8vw published
Jan 19, 2024 by patak-catHigh -
XSS vulnerability in `server.transformIndexHtml` via URL payloadGHSA-92r3-m2mg-pj97 published
Dec 4, 2023 by patak-catModerate -
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)GHSA-353f-5xf4-qw67 published
Jun 1, 2023 by patak-catHigh